Port Monitor: open ports, connections and web sessions

What it is for

The Port Monitor shows which network ports are open on the nodes of the EasyUC appliance, which connections currently exist and who was active on the web interfaces in the last few minutes. You need it for firewall rules, for security reviews and to clarify whether a service can be reached at all.

The data comes from a collector that reads the existing sockets of the host and of the EasyUC containers on every node every 2 seconds, and from the published services of the cluster. The collector reads only socket metadata and process names, no packet contents. Web sessions are derived from authenticated requests to the interfaces.

The monitor is a snapshot. Very short connections can start and end between two captures. It replaces neither a packet capture nor a complete history. In addition, a full port scan of the configured EasyUC address can be started from the network of the EasyUC API.

Prerequisites

• Administrator role: ROLE_APP_ADMIN, ROLE_OWNER, ROLE_ADMIN or ROLE_SUPER_ADMIN. Other accounts receive the message "The Port Monitor is available to administrators only."
• The Port Monitor collector is an optional add-on of the appliance and must be installed on the nodes. Without it the node data is missing.
• Sign-in is fully completed, including two-factor authentication if active.

Step by step: check ports and connections

1. Open Administration → System & Operations → Port Monitor. In the ACD and Teams areas the entry is under System.
2. In the Captured scopes and coverage box, check that every node has the status Captured.
3. Read the four figures at the top: Known listeners, Incoming connections, Outgoing connections and Recently active web sessions. A click jumps to the respective table.
4. Choose a node under Node / scope or leave All nodes selected.
5. Under Search, enter a port, a service, a user or an IP address. The filter applies to all three tables.
6. In the Listeners and published ports table, open Details in the row you are looking for. It shows Purpose and Disable / secure.
7. In the Current connections table, choose for example Incoming under Direction to see only incoming connections.
8. With Live on the page refreshes every 5 seconds. Click it to switch to Live paused when you want to read a snapshot at leisure. Refresh reloads once.

Step by step: check external reachability

1. Scroll down the page to Check external reachability.
2. Click Start full port scan. EasyUC checks all 65,535 TCP ports of the configured EasyUC address. This can take up to 45 seconds.
3. Read the result: target, notice text, number of reachable TCP ports and, per port, service and purpose.
4. Compare the list with your firewall rules. Every port that appears here and is not needed should be blocked at the firewall.

Fields and options

How to read the tables

Check the result and narrow down errors

• The display is reliable when all nodes report Captured and no notice about incomplete coverage appears.
• "Coverage is incomplete. Counts reflect captured scopes; a dash means unknown data.": at least one node supplies no data or old data. Check whether the collector is running on that node.
• "Stale observation – current activity is unknown.": the connection row comes from a node without a fresh snapshot.
• "Reliable data is unavailable for this scope.": the table stays empty because capture is missing. This is no proof that no ports are open.
• "Port information could not be loaded." with the addition "The last successful snapshot remains visible.": the query failed. The values shown are old.
• HTTPS appears twice: as published port 443 and as the actual listener of the ingress on a different port. This is normal and can be seen in the Evidence column.
• A web session does not equal a single TCP connection. Reverse proxy and NAT can combine connections or change addresses.
• Port scan: "Die konfigurierte EasyUC-Adresse konnte nicht aufgelöst werden." or the notice that the address lies in a blocked network means that no scan ran (the server returns these messages in German). Check the configured address of the appliance.
• "The external port scan failed.": repeat the scan after a short time. The scan runs from the network of the EasyUC API and does not replace a scan from outside your firewall.